Flight Operational Safety Assessment (FOSA) a tool in establishing RNP AR Approaches

Transcription

1 Flight Operational Safety Assessment (FOSA) a tool in establishing RNP AR Approaches EASA Workshop, 20 th October 2010 Edward Smith (DNV)

2 Presentation Contents What do the PBN manual and AMC say? When and why is a FOSA needed? How should a FOSA be conducted? EUROCONTROL guidance document Lessons learnt so far Concluding remarks 2

3 PBN Manual and AMC PBN Manual - A FOSA should be conducted for RNP AR APCH procedures where aircraft specific characteristics, operational environment, obstacle environment, etc., warrant an additional review to ensure operational safety objectives are still achieved. The assessment should give proper attention to the interdependence of the elements of design, aircraft capability, crew procedures and operating environment. AMC A FOSA should be conducted for each RNP AR approach procedure where: - More stringent aspects of the nominal procedure design criteria are applied (e.g. RF legs, RNP final approaches less than 0.3 and missed approaches less than 1.0) - The application of the default procedure design criteria is in an operating environment with special challenges or demands They do not say that a FOSA is needed for every RNP AR APCH procedure 3

4 Why is a FOSA needed? Procedure design no buffers or tapering of obstacle clearance areas Curved paths (RF legs) RNP values on final approach below 0.15NM 4 RNP MOC: as per VEB 2 RNP What happens, for example, if: - Undetected erroneous aircraft position calculation in one FMS - will aircraft remain within 2RNP? - Double FMS loss - will pilots be able to extract aircraft safely at all points on the approach? - High winds and precipitous terrain, etc. With these challenging procedures, timely pilot inputs are even more critical 4

5 Guidance on FOSA How to conduct one? When the PBN manual and AMC were being drafted there was not much guidance on FOSA 2-3 pages of helpful hints A number of stakeholders were asking what do we need to do? ICAO s Instrument Flight Procedures Panel (IFPP) expressed concern about lack of guidance EUROCONTROL took action to address this concern in the absence of any other willing organisation at the time 5

6 Overall Approval Package FOSA is part of the overall documentation package, including: - Aircraft qualification and capability; - Procedure and airspace design; - Navigation data base validation programme; - Maintenance procedures; - Training (flight crew, dispatch, ATC); - MEL revision (as required); - Operational procedures requirements; - Conditions or limitations for approval; - Air traffic environment and operations; and - RNP monitoring programme. 6

7 Objectives of a FOSA The FOSA should ensure that for each specific set of operating conditions, aircraft and environment, all failure conditions are assessed and, where necessary, mitigations are implemented to meet the safety criteria. The assessment should give proper attention to the interdependence of the elements of procedure design, aircraft capability, crew procedures and operating environment. Flight Crew Operations Aircraft Failures Aircraft Performance FOSA Operating Conditions Navigation/ Information Services Infrastructure ATC Operations FOSA acts as the glue, ensuring all these elements add up to a safe whole 7

8 Examples of Dependencies - 1 If there are aircraft failures or extreme operating conditions do the flight crew know how to respond? Flight Crew Operations Aircraft Performance FOSA Navigation/ Information Services Infrastructure Aircraft Failures Operating Conditions ATC Operations 8

9 Examples of Dependencies - 2 If there are aircraft failures or extreme operating conditions do the flight crew know how to respond? Aircraft Performance Navigation/ Information Services If ATC provides a clearance for an RNP AR APCH to an aircraft/ crew not suitably equipped/ approved do the flight crew know what to do? Flight Crew Operations Aircraft Failures FOSA Operating Conditions Infrastructure ATC Operations 9

10 Examples of Dependencies - 3 If there are aircraft failures or extreme operating conditions do the flight crew know how to respond? Aircraft Performance Navigation/ Information Services If ATC provides a clearance for an RNP AR APCH to an aircraft/ crew not suitably equipped/ approved do the flight crew know what to do? If there is an infrastructure problem, what information needs to be provided, does ATC know how to react, do flightcrew know what the impact will be? Flight Crew Operations Aircraft Failures FOSA Operating Conditions Infrastructure ATC Operations Such dependencies in context of a specific, potentially challenging, procedure where timely decisions could be critical 10

11 EUROCONTROL Project Case Study 1 - Bastia Bastia, Corsica, France Working group members - DGAC/ DSNA/ Air France/ Airbus/ Thales Several iterations on the procedure design all flown in simulator, Airbus A320 Series of safety workshops informal optimisation of design + formal FOSA sessions 11

12 EUROCONTROL Project Case Study 2 - Tromsø Tromsø, Norway Working group members Luftfartstilsynet/ Avinor/ SAS Design submitted to ANSP and carrier at end of November 2008 Simulator trials carried out in Jan 2009, Boeing 737NG Safety workshop in May 2009 Test flights completed in Aug

13 Key FOSA Characteristics Primarily an aircraft centred qualitative assessment However, needs to take account of factors outside the aircraft, e.g. ATC, procedure design, specific navigation infrastructure, etc. Historic reliance on subject mater expert assessment Relies on aircraft airworthiness certification process FOSA extends examination of hazards and mitigations 13

14 FOSA Steps - Overview 1. System definition 2. Setting safety criteria 3. Identification of hazards 5. Causal analysis & likelihood estimation 4. Consequence analysis 6. Determination of potential mitigations 7. Risk acceptability Meets criteria Fails to meet criteria Risk reduction measures 8. Documentation of FOSA 14

15 FOSA Step 1 Step 1 System Definition - Information to be gathered: - Procedure design - Aircraft, e.g. compliance against AMC Flight crew & dispatch procedures and training - Proposed MEL - Nav infrastructure - ATC facilities - Airport and airspace environment - Etc. - Assumptions checklists (e.g. against AMC 20-26, section 4) 5. Causal analysis & likelihood estimation 1. System definition 2. Setting safety criteria 3. Identification of hazards 6. Determination of potential mitigations 7. Risk acceptability 4. Consequence analysis Meets criteria Fails to meet criteria Risk reduction measures 8. Documentation of FOSA 15

16 FOSA Step 2 Step 2 Setting Safety Criteria - Primarily qualitative, e.g. - Risk Reduced As Far/ Low As Reasonably Practicable - Risk no greater than current operations 1. System definition 2. Setting safety criteria 3. Identification of hazards - Quantitative, for equipment, e.g. - The lateral excursions observed as a result of Probable failures should be documented against an objective of containment within 1xRNP 5. Causal analysis & likelihood estimation 6. Determination of potential mitigations 7. Risk acceptability 4. Consequence analysis Meets criteria Fails to meet criteria Risk reduction measures 8. Documentation of FOSA 16

17 FOSA Step 3 Hazard Grouping ATC Operations Hazard Ref. ATC 01 Hazard Procedure assigned to incapable aircraft Reference / Source PBN / AMC Step 3 Hazard ID - Group based workshops are an effective method ATC 02 Inappropriate vectoring or Direct To PBN / AMC Mix of skills and knowledge ATC 03 Separation or sequencing errors Previous Eurocontrol Safety Case - Supported by checklists ATC 04 Provision of incorrect pressure and/or temperature data Previous Eurocontrol Safety Case ATC 05 Lost communications Previous Eurocontrol Safety Cases Flight Crew Operations FC 01 Erroneous barometric altimeter settings Example Hazard Checklist PBN / AMC

18 FOSA Step 4 Step 4 Consequence analysis 1. System definition Hazard Consequences Consequential Mitigations Navigation database errors (NS 01) Vertical or lateral deviation from intended route Loss of obstacle / terrain clearance Reasonableness check of track angles and distances. Runway threshold co-ordinate check anchors this. VOR Radial check EGPWS / TAWS Class A 5. Causal analysis & likelihood estimation 2. Setting safety criteria 3. Identification of hazards 6. Determination of potential mitigations 4. Consequence analysis Example Table 7. Risk acceptability Meets criteria 8. Documentation of FOSA Fails to meet criteria Risk reduction measures 18

19 FOSA Step 5 Step 5 Causal analysis 1. System definition Hazard: Causes Procedure design error Database out of date Navigation database errors (NS 01) Causal Mitigations Followed ICAO PANS-OPS and PBN RNP AR Procedure Design Manual Verification of procedure design by peer review Flight test of procedure has been completed Airline AIRAC cycle update procedures Currency of database checked for entire flight (PBN 6.3.4) 5. Causal analysis & likelihood estimation 2. Setting safety criteria 3. Identification of hazards 6. Determination of potential mitigations 4. Consequence analysis Example Table 7. Risk acceptability Meets criteria 8. Documentation of FOSA Fails to meet criteria Risk reduction measures 19

20 FOSA Steps 6 & 7 Step 6 Mitigations ATC Operations Hazards Hazard Procedure assigned to incapable aircraft or crew (ATC 01) Planned Causal Mitigations - Flight Crew are responsible for declining inappropriate clearance - Flight crew check of AR equipment availability prior to approach - Approach specific training for ATC (PBN 6.2.6) Example Table Planned Consequential Mitigations Go-around if approach is not fully prepared Potential Extra Mitigations In trial and early operations, flight crew will ask ATC for RNP AR approach. Will not be offered always on request. Special phraseology to be developed. - Document planned mitigations - Identify potential extra mitigations Step 7 Risk Acceptability - Look at hazard v mitigations balance - Determine mitigations which are required 20

21 FOSA Step 7 (cont d) Example Aircraft Failure Hazard Failures Likelihood Consequences Extra Mitigations Risk Acceptability? Undetected erroneous A/C position calculation in one FMS SSA evaluated probability as Remote (between 10-5 and 10-7 per approach) Contained within 0.4NM. Implies RNP non norm = 0.2NM Demonstrated and documented in accordance with AMC TAWS Class A Contingency procedures Specific procedure significantly less onerous than one used in airworthiness approval for AMC Risk acceptable. 21

22 FOSA Step 8 Step 8 Documentation of FOSA - Introduction (including justification for introduction of an RNP AR APCH, benefits etc.); - Description of the system (as per Step 1 above); - Overview of safety assessment process and safety criteria used; - Identification of relevant hazards, causes and consequences; - Documentation of relevant mitigations and determination of risk acceptability for RNP AR operations; - Key issues to be monitored; - Assumptions and open items to be validated and closed out; - Conclusions/ Recommendations; - Appendices with supporting information. 5. Causal analysis & likelihood estimation 1. System definition 2. Setting safety criteria 3. Identification of hazards 6. Determination of potential mitigations 7. Risk acceptability 8. Documentation of FOSA 4. Consequence analysis Meets criteria Fails to meet criteria Risk reduction measures 22

23 Linkage to AMC RNP System Performance Analysis Normal Aircraft Performance Aircraft Failures Analysis RNP norm RNP non norm Ops Package Analysis in context of demanding environment/ procedure Failures based on existing SSAs Flightdeck procedures and recommended training AMC Reqts. OEM Certification Aircraft Performance Aircraft Failures Flight Crew Operations In context of specific environment & procedure + ATC Operations Nav Services Infrastructure Operating Conditions FOSA Aircraft Operator Approval 23

24 Scale of FOSA e.g RNP non norm 1. Potential for less detailed FOSA Airworthiness Certification 2. Detailed FOSA Proposed RNP value for procedure Operational Needs Analysis e.g RNP norm 3. Not Achievable 24

25 Typical Participants in a FOSA FOSAs are often initiated by an Aircraft Operator (AO) wishing to obtain approval to fly an RNP AR procedure. In conducting the FOSA the AO will obtain inputs from: - Aircraft and Avionics Manufacturers; and - Air Navigation Service Provider (Procedure Designer, Air Traffic Controllers, Airspace Planners, Navaid Infrastructure Specialists, AIM Department, etc.). In addition various parts of an AO s organisation will need to be involved, i.e. Flight Crew, Flight Operations Department, Dispatchers, Technical Support and Maintenance. 25

26 FOSA and the ANSP Safety Case When the RNP AR procedure is a new implementation this will represent an ATM change and an Air Navigation Service Provider (ANSP) may also be expected to undertake a safety risk assessment. For example a European ANSP will be expected to undertake a safety risk assessment compliant with ESARR4 or Commission Regulation No. 2096/ ANSP safety case for the RNP AR operation will draw on FOSA findings and will have to validate any ANSP-specific assumptions made during the FOSA (ATC phraseology, ATC contingency procedures etc) The ANSP safety case and the FOSA must be compatible 26

27 Approval Process Seeking Efficiencies An approval is specific to a given combination of RNP AR approach, aircraft type and AO. This presents organisational challenges in the case of a foreign AO wanting to conduct an RNP AR APCH. It would be expected that the foreign AO liaise with the relevant European ANSP to ensure that their respective safety studies are consistent and to ensure that they will be allowed to use the RNP AR approach. This liaison may involve the ANSP or relevant regulator supplying information about what is required in the FOSA and what special safety requirements have been applied to other AOs using that particular RNP AR procedure. It would clearly be helpful if the FOSA conducted by the first AO to fly the RNP AR procedure was available to subsequent AOs, although it must be ensured that each AO complete the RNP AR implementation process fully. 27

28 Lessons Learnt Needs to be clear operational need for RNP AR APCH Value of early iterations Benefits of simulations Advantages of multi-disciplinary teams Impact of location specific factors Charting issues 28

29 Value of Early Iterations Before After 29

30 Conclusions FOSA is a valuable tool in establishing the safety of RNP AR APCH operations and in facilitating approval. FOSA provides a systematic process for checking that risks are adequately mitigated across the range of hazards. EUROCONTROL s FOSA guidance fills a gap and provides a tested basis for further development. Future guidance planned looking at RNP AR traffic separation applications and departures. 30

31 Safeguarding life, property and the environment 31